Copy Magic Under RHEL5.1?

Being an instructor for Guru Labs, I have the opportunity to not only teach Guru Labs courseware, but also contracted work with Red Hat, HP, IBM, Oracle and others. This week, I'm out in Atlanta, Georgia teaching the RH300 Rapid Track course for students to earn their RHCE. During one of the labs, we noticed the following anomoly with the 'cp' command under RHEL5.1. As such, I'm wondering if anyone has some insight as to what is going on. Consider the following scenario:

SELinux is running in Enforcing mode. A new index.html file is created in a user's home directory. As such, SELinux will label the type context as 'user_home_t'. If I were to copy this file to /var/www/html/ with -p as a switch, it should preserve the context as per the man page:

Yet, the context is not preserved, and a new security type context applied, specifically, 'http_sys_content_t', which it should be if Apache wants to serve that index.html file while SELinux is in enforcing mode. However, if you use the -a switch to perform the copy, the original context is held in place. According to the man page, -a is the same as -dpR. Again, per the man page:

-a, --archive
same as -dpR

[snip]

-d same as --no-dereference --preserve=link

[snip]

-P, --no-dereference
never follow symbolic links

-p same as --preserve=mode,ownership,timestamps

[snip]

-R, -r, --recursive
copy directories recursively

Certainly -R is not preserving the context, and as we saw previously, -p isn't either. So, this concludes that -d is preserving the context? Yet, -d only deals with symbolic links, not security contexts. So, the question is, what am I missing with 'cp -p' vs 'cp -a' to preserve security contexts?

Posted by Aaron Toponce on Thursday, January 24, 2008, at 8:03 am.Filed under Linux.Follow any responses to this post with its comments RSS feed.You can post a comment or trackback from your blog.For IM, Email or Microblogs, here is the Shortlink.